IN THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1. (Currently amended) A system comprising: 

a processor; and 

a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions which when executed cause the processor to: 

determine one or more quantify quantities of damages avoided by one or more 
blocked attacks; and 

calculate security consumption during a period of time. 

2. (Currently amended) The system of claim 1, wherein quantifying determining one or more 
quantities damages includes determining whether a blocked attack would have exploited a 
network vulnerability. 

3. (Previously presented) The system of claim 2, wherein determining whether a blocked attack 
would have exploited network vulnerability includes replaying the attack on an internal network. 

4. (Previously presented) The system of claim 1, further comprising a scanner configured to 
scan one or more devices for vulnerabilities. 

5. (Previously presented) The system of claim 4, wherein the scanner is configured to quantify 
the risk of one or more devices. 

6. (Previously presented) The system of claim 4, wherein the scanner is located within a 
customer network. 

7. (Previously presented) The system of clam 1, further comprising an intrusion suppression 
module configured to block attacks. 
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8. (Previously presented) The system of claim 7, wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time. 

9. (Previously presented) The system of claim 7, wherein the intrusion suppression module is 
located outside a customer network. 

10. (Currently amended) A network security method comprising: 

determining one or more quantifying quantities of damages avoided by one or more 
blocked attacks; and 

calculating security protection consumption during a period of time. 

11. (Previously presented) The method of claim 10, further comprising determining whether a 
blocked attack would have exploited network vulnerability. 

12. (Previously presented) The method of claim 10, further comprising scanning one or more 
devices for vulnerabilities. 

13. (Previously presented) The method of claim 12, further comprising quantifying the risk of 
one or more devices. 

14. (Previously presented) The method claim 1, further comprising blocking one or more 
attacks. 

15. (Previously presented) The method of claim 14, further comprising maintaining a list of 
attacks sustained and blocked during a period of time. 

16. (Currently amended) A network security apparatus comprised of: 

means for determining one or more quantifying quantities of damages avoided by one or 
more blocked attacks; and 

means for calculating security protection consumption during a period of time. 
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17. (Original) The apparatus of claim 16, further comprised of the means for determining 
whether a blocked attack would have exploited network vulnerability. 

18. (Original) The apparatus of claim 16, further comprised of the means for scanning one or 
more devices for vulnerabilities. 

19. (Original) The apparatus of claim 18, further comprised of the means for quantifying the risk 
of one or more devices. 

20. (Original) The apparatus claim 16, further comprised of the means for blocking one or more 
attacks. 

21 . (Original) The apparatus of claim 20, further comprised of the means for maintaining a list 
of attacks sustained and blocked during a period of time. 

22. (Currently amended) A computer program product embodied in a tangibl e computer- 
readable storage medium, and comprising computer executable instructions for: 

determining one or more quantifying quantities of damages avoided by one or more 
blocked attacks; and 

calculating security protection consumption during a period of time. 

23. (Previously presented) The computer program product of claim 21, further comprising 
computer instructions for determining whether a blocked attack would have exploited network 
vulnerability. 

24. (Previously presented) The computer program product of claim 21, further comprising 
computer instructions for scanning one or more devices for vulnerabilities. 

25. (Previously presented) The computer program product of claim 21, further comprising 
computer instructions for quantifying risk of one or more devices. 
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26; (Cancelled) 



27. (Cancelled) 

28. (Cancelled) 

29. (New) The system of claim 1 wherein the processor is configured to calculate security 
consumption including by determining a monetary value associated with the damages avoided. 

30. (New) The system of claim 1 wherein the processor is configured to determine one or more 
quantities at least in part by determining a first portion of damages avoided by a customer and by 
determining a second portion of damages avoided by a party other than the customer on behalf of 
the customer. 

3 1 . (New) The system of claim 1 wherein the processor is configured to determine one or more 
quantities at least in part by determining a count of the one or more blocked attacks. 
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